Merge "Add packet length check for received AVCTP packets" into oc-dev (3751783b) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/avct/avct_bcb_act.cc

+9 −0

Original line number	Original line	Diff line number	Diff line
	@@ -25,6 +25,7 @@
	*		*
	*****************************************************************************/		*****************************************************************************/

			#include <log/log.h>
	#include <string.h>		#include <string.h>
	#include "avct_api.h"		#include "avct_api.h"
	#include "avct_int.h"		#include "avct_int.h"
	@@ -517,6 +518,14 @@ void avct_bcb_msg_ind(tAVCT_BCB* p_bcb, tAVCT_LCB_EVT* p_data) {
	return;		return;
	}		}

			if (p_data->p_buf->len < AVCT_HDR_LEN_SINGLE) {
			AVCT_TRACE_WARNING("Invalid AVCTP packet length %d: must be at least %d",
			p_data->p_buf->len, AVCT_HDR_LEN_SINGLE);
			osi_free_and_reset((void**)&p_data->p_buf);
			android_errorWriteLog(0x534e4554, "79944113");
			return;
			}

	p = (uint8_t*)(p_data->p_buf + 1) + p_data->p_buf->offset;		p = (uint8_t*)(p_data->p_buf + 1) + p_data->p_buf->offset;

	/* parse header byte */		/* parse header byte */